Apparatus for dividing the elements of a Galois field

ABSTRACT

An apparatus divides one element α i  of a Galois field GF(2 m ) by another element α j  of the field. Divider data α j  are supplied to one of the first linear shift registers and to the other first linear shift registers through α N1 , α N2 , . . . multiplier circuits, respectively. Simultaneously, dividend data α i  are supplied to one of the second linear shift registers and to the other second linear shift registers through α N1 , α N2 , . . . multiplier circuits, respectively. &#34;1&#34; detector circuits are connected to the outputs of the first linear shift registers, respectively. The first linear shift registers and the second linear shift registers are shifted several times until any &#34;1&#34; detector circuit detects &#34;1&#34; in response to output signals from a 2-input AND gate. When &#34;1&#34; is detected, a NOR gate supplies a signal of logical &#34;0&#34; to the AND gate, whereby the AND gate stops supplying output signals. 2-input AND circuits are connected at one input terminal to the outputs of the &#34;1&#34; detector circuits and at the other input terminal to the outputs of the second linear shift registers. The AND circuit connected to the &#34;1&#34; detector circuit supplies the data stored in the second linear shift register to which it is connected. The data representing the quotient of the division α i  -α j , are delivered through an OR circuit.

BACKGROUND OF THE INVENTION

The present invention relates to an apparatus for dividing the elementsof a Galois field, which can effectively serve to decode an errorcorrection code used in an optical DAD (digital audio disk) deviceusing, for example, a CD (compact disk).

Various optical DAD devices have been developed recently. As is wellknown, in an optical DAD device using a compact disk, cross-interleavedReed Solomon codes (CIRC) are used as error correction codes. Across-interleaved Reed Solomon code is obtained by submitting a ReedSolomon code, which is a BCH code and which is generally regarded as themost effective random error correction code hitherto known, to a signalprocess called "cross-interleaving". The cross-interleaved Reed Solomoncode thus obtained can correct even a burst error.

A Reed Solomon code can be decoded in the same way as is a BCH code,thereby performing an error correction.

A Reed Solomon code consisting of k data symbols and (n-k) inspectionsymbols, i.e., a code consisting of n symbols, is decoded in thefollowing manner. Here, n symbols are the 2^(m) elements of a finitefield called "Galois field GF(2^(m))" which represents m binary bits.The generator polynomial g.sub.(x) representing a Reed Solomon code usedto correct an error t times is given by the following equation (1) or(2), where α is the origin element of the Galois field GF (2^(m)):

    g.sub.(x) =(x+α)(x+α.sup.2), . . . (x+α.sup.2t)(1),

    g.sub.(x) =(x+α.sup.0)(x+α), . . . (x+α.sup.2t-1) (2).

Let C.sub.(x), R.sub.(x) and E.sub.(x) denote a transmitted code word, areceived code word and an error polynomial respectively, then:

    R.sub.(x) =C.sub.(x) +E.sub.(x)                            ( 3).

The coefficients contained in polynomial E.sub.(x) are also contained inGalois field GF (2^(m)). Hence, the error polynomial E.sub.(x) containsonly terms which correspond to an error location and the value (i.e.,size) of an error.

Let X_(j) denote an error location, and let Y^(j) denote the value ofthe error at location X^(j). Error polymoninal E.sub.(x) is then givenas: ##EQU1## where Σ is the sum of errors at all error locations. Here,syndrome S_(i) is put:

    S.sub.i =R(α.sup.i) [i=0, 1, . . . 2t-1]             (5).

Then, from equation (3):

    S.sub.1 =C(α.sup.i)+E(α.sup.i).

Both C.sub.(x) and g.sub.(x) can be divided, leaving no remainder. Thefollowing therefore holds true:

    S.sub.i =E(α.sup.i).

From equation (4) it is evident that syndrome S_(i) may be expressed asfollows:

    S.sub.i =E(α.sup.i)=Σ Y.sub.j (α.sup.i).sup.j =Σ Y.sub.j X.sub.j.sup.i                                     ( 6),

where α^(j) =X_(j) and X_(j) represents the error location for α^(j).

Error location polynomial σ.sub.(x) is given by: ##EQU2## where e is thenumber of errors.

σ_(l) to σ_(e) in equation (7) are related to syndrome S_(i) as shownbelow:

    S.sub.i+e +σ.sub.1 S.sub.i+e-1 +. . . σ.sub.e-1 S.sub.i+1 +σ.sub.e S.sub.i                                    ( 8).

In other words, such a Reed Solomon code as defined above is decoded inthe following steps:

(I) Calculate syndrome S_(i) [equation (5)].

(II) Obtain coefficients σ₁ to σ_(e) contained in error locationpolymonial σ.sub.(x) [equation (8)].

(III) Find the root X_(j) of error location polynomial σ.sub.(x)[equation (7)].

(IV) Find error value Y_(j) [equation (6)], and calculate errorpolynomial [equation (4) ].

(V) Correct errors [equation (3)].

Now it will be described how to decode, in the above-mentioned steps, aReed Solomon code consisting of many block data each containing fourinspection symbols. This code is represented by the following polynomialg.sub.(x) :

    g.sub.(x) =(x+1)(x+α)(x+α.sup.2)(x+α.sup.3).

In this case, an error can be corrected two times. The Reed Solomon codemay be decoded in the following method A or the following method B.

[Method A]

(I) Find syndromes S₀ to S₃.

(II) Rewrite equation (8) for e=1 and e=2. ##EQU3##

Assume that the decoder used starts functioning with the case of e=1.Solution σ₁ must then be given which satisfies simultaneous equations(9). If no solution σ₁ is found, the decoder must find solutions σ₁ andσ₂ which satisfy simultaneous equations (10). If still no solution σ₁ orσ₂ is found, then: e=3.

Solution σ₁ of equations (9) is: ##EQU4##

Solutions σ₁ and σ₂ of equations (10) are: ##EQU5##

(III) If coefficient σ₁ in the error location polynominal is obtained,find the root of the error location polynominal [equation (7)]. ##EQU6##

Substituting the elements of Galois field GF(2^(m)) in equation (11) oneafter another will yield roots X₁ and X₂.

(IV) If roots of the error location polynominal are found, determineerror value Y_(j) [equation (6)]. ##EQU7##

(V) Correct error using correction values Y₁ and Y₂ thus obtained.

If the value of an error location is correctly found by the pointererasure method, the Reed Solomon code used to correct an error twice canbe used to correct an error four times in the following method B.

[Method B]

(I) Find syndromes S₀ and S₃.

(II), (III) Find the error location in different methods.

(IV) Find the error value [equation (6)]. ##EQU8##

Solve these simultaneous equations, thus finding Y₁, Y₂ and Y₃ :##EQU9##

Solve these simultaneous equations, thus finding Y₁, Y₂, Y₃ and Y₄ :##EQU10##

(V) Correct error, using correction values Y₁, Y₂, Y₃ and Y₄ thusobtained.

FIG. 1 is a block diagram of a known data correcting system which isdesigned to decode Reed Solomon codes in the manner described above.Data to be corrected are supplied through an input terminal IN and willbe corrected by a Reed Solomon code. The data are stored in a databuffer 11 and kept stored there until a code decoding (later described)is completed. The data are supplied also to a syndrome calculator 12.The calculator 12 calculates a syndrome based on the input data and thesyndrome is then stored in a syndrome buffer 13.

An OR gate is coupled to the output of the syndrome buffer 13. Itgenerates an output signal which indicates whether or not an errorexists in the syndrome supplied from the syndrome buffer 13. An outputsignal from the OR gate is supplied to an error location polynomialcalculator 15. Upon receipt of the signal the calculator 15 finds thecoefficients included in an error location polynomial σ.sub.(x). Datarepresenting the coefficients are fed to an error location calculator16. The error location calculator 16 then finds the root or roots of theerror location polynomial. Data representing the root or roots aresupplied from the calculator 16 to an error value calculator 17. Fromthe input data the calculator 17 calculates an error value. The datarepresenting the root or roots and the data representing the error valueare used to correct the data from the data buffer 11.

The calculators 12, 15, 16 and 17 of the data correcting system candetect elements which are "0" and can therefore perform algebraicoperations such as addition, multiplication or division. Of thesecalculators, the error location polynomial calculator 16 may have such astructure as shown in FIG. 2 and disclosed in U.S. Pat. No. 4,142,174.

As shown in FIG. 2, the error location polynomial calculator 16comprises a syndrome buffer 21, a working buffer 22, a sequencecontroller 23, a logarithm buffer 24 and an antilogarithm buffer 25. Thesyndrome buffer 21 is a random-access memory (RAM) for storing asyndrome S_(i) which is m-bit data and which represents each element ofa Galois field GF(2^(m)). The working buffer 22 is a RAM for storing aninterim result of an algebraic operation performed in finding thecoefficients of the error location polynomial and for storing the finalresult of the algebraic operation. The working buffer 22 may storepartial results that will be used in algebraic operations which followthe operations for calculating the coefficients of the error locationpolynomial. The sequence controller 23 defines the order in whichalgebraic operations will be performed. It supplies address signals tothe syndrome buffer 21 and the working buffer 22, to thereby designatedesired memory locations of these buffers 21 and 22 and to check andbranch the results of algebraic operations so that the results may beused in the next algebraic operations. The logarithm buffer 24 is a ROM(read-only memory) storing a table of the logarithms of the elements ofa Galois field GF(2^(m)). The antilogarithm buffer 25 is also a ROMstoring a table of the antilogarithms of the elements of a Galois fieldGF(2^(m)).

The address of the logarithm buffer 24 is a binary code of elementα^(i). Its entry is the logarithm of α to the base a that is, i. Theentry at address i of the antilogarithm buffer 25 is a binary code ofα^(i).

Suppose the modulus polynomial F.sub.(x) of a Galois field GF(2⁸) isgiven by:

    F.sub.(x) =x.sup.8 +x.sup.6 +x.sup.5 +x.sup.4 +1.

The elements of Galois field GF(2⁸) other than element 0 can then berepresented by a linear combination of powers to the root α of F.sub.(x)=0, or α⁰ -α⁷, which is expressed as follows: ##EQU11##

In this case, eight coefficients a₀ to a₇ may be taken and can berepresented as binary vectors. For example, they can be given by:##EQU12##

The elements of the Galois field GF(2⁸) other than these can berepresented as binary vectors.

The addresses 1-255 of the logarithm table are 8-bit binary vectors ofelements α^(i). Entries corresponding to the addresses are in binarynotation of exponent i. In the antilogarithm table, exponent i is usedas an address, and entries are binary vectors of α^(i).

How the error location polynomial calculator shown in FIG. 2 performsalgebraic operations will now be described.

(1) Addition

In order to add element α^(i) and element α^(j), the former is suppliedfrom A register 20 to an exclusive OR gate 27 and the latter is suppliedfrom B register 26 to the exclusive OR gate 27. An exclusive logical sumof each bit of element α^(i) and the corresponding bit of element α^(j)is thus produced. The logical sum of elements α^(i) and α^(j) obtainedby the exclusive OR gate 27 is transferred through C register 19 to theworking buffer 22.

(2) Detection of Element "0"

In order to detect whether or not element α^(i) is "0" , the element issupplied from H register 28 to an OR gate 29, which produces a logicalsum. The logical sum is transferred via M register 30 to the workingbuffer 22. The contents of M register 30 are "0" , only when elementα^(i) is "0".

(3) Multiplication

In order to multiply element α^(i) by element α^(j), it is firstdetected whether or not these elements are "0". If at least one of theseelements is "0" , it is learned without performing the multiplicationthat the product will be "0". If neither is "0" , the elements areloaded into an address register 31 which is connected to the logarithmbuffer 24. Outputs i and j from the logarithm buffer 24 are supplied toa ones complement adder 34 through D register 32 and E register 33,respectively. The ones complement adder 34 performs addition of acomplement to 1, using 2⁸ -1 as a modulus. The result of this addition,(i+j)=t mod (28-1) is loaded through L register 35 into an addressregister 36 which is connected to the antilogarithm buffer 25. If theaddress input of the antilogarithm buffer 25 is t, the antilogarithmbuffer 25 supplies an output α^(t). The output α^(t) is the product ofelements α^(i) and α^(j) and is transferred to the working buffer 22through G register 37.

(4) Division

In order to divide element α^(i) by element α^(j) to obtain a quotientα^(i) /α^(j), a method similar to the above-mentioned multiplication isused, but the contents of E register 33 are subtracted from the contentsof D register 32. More specifically, the logarithm of element α^(j)stored in E register 33 is complemented by a complementer 38. The outputdata of the complementer 38 are supplied to the complement adder 34 viaF register 39. Thereafter, the data are processed in the same way as inmultiplying element α^(i). In this case, the output from theantilogarithm buffer 25 is the quotient, i.e., the result of thedivision.

The error location polynomial calculator of the known error correctingsystem must be provided with a logarithm buffer and an antilogarithmbuffer. Without these buffers, the error location polynomial calculatorcould not perform multiplication or division. Both buffers, which areROMs, need to have an enormously large memory capacity. This makes itdifficult to manufacture the error location polynomial calculator in theform of an LSI. In order to make the calculator in the form of an LSI,the logarithm buffer and the antilogarithm buffer must be excluded fromthe calculator. In this case, the buffers having a large memory capacityhave to be connected to the calculator.

If one symbol consists of eight bits and each buffer stores 255 symbols,the buffer must have a memory capacity of 2040 bits (=255×8). In thiscase, the known error location polynomial calculator is provided withtwo ROMs the total memory capacity of which amounts to 4080 bits. One ofthe ROMs stores a table of logarithms and the other ROM stores a tableof antilogarithms. Since its error location polynomial calculator hastwo ROMs both with a large memory capacity, the error correcting systemis inevitably complicated, and thus expensive.

SUMMARY OF THE INVENTION

An object of the present invention is to provide an apparatus fordividing the elements of a Galois field, which has neither a logarithmbuffer nor an antilogarithm buffer, both of which require a large memorycapacity, and which therefore has a simple structure and can bemanufactured at low cost.

An apparatus according to the invention divides one element α^(i) of theGalois field GF(2^(m)) by another element α^(j) of the Galois fieldGF(2^(m)), where α is a root of modulus polynomial F.sub.(x). In otherwords, the apparatus performs the division: α^(i) ÷α^(j) (=α^(i-j)).Data representing element α^(j) are supplied to one of the first linearshift registers through a data line and to the other first linear shiftregisters through data lines and then through α^(N1), α^(N2) . . .multiplier circuits (1<N1<N2, . . . ). Data representing α^(i) aresupplied to one of the first linear shift registers through a data lineand to the other first linear shift registers through data lines andthen through other α^(N1), α^(N2), . . . multiplier circuits (1<N1<N2, .. . ). A plurality of "1" detector circuits are connected to the outputsof the first linear shift registers, respectively, to detect whether ornot the outputs from the first linear shift registers represent "1".Until any one of the "1" detector circuits detects "1", the first linearshift registers and the second linear shift registers are shiftedseveral times by shift means. A plurality of 2-input gate circuits areconnected at one input to the outputs of the "1" detector circuits,respectively, and at the other input to the outputs of the second linearshift registers, respectively. The output data from the second linearshift register which corresponds to the first linear shift registerconnected to the "1" detector circuit which detects "1" are deliveredthrough output means as data representing the quotient of the division.

According to the present invention, the elements of the Galois fieldGF(2^(m)) are divided by using linear shift registers. More precisely,the linear shift registers are used to multiply the elements of theGalois field GF(2^(m)) and ulimately, to divide the elements of theGalois field GF(2^(m)). Both dividend α^(i) and divider α^(j) aremultiplied by α a proper number of times before the data representingthem are supplied to the linear shift registers, and so the linear shiftregisters need to be shifted fewer times than otherwise, thus performingmultiplication (and ultimately, division) in a shorter time.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a system for decoding a Reed Solomon code;

FIG. 2 schematically shows a conventional error location polynomialcalculator;

FIG. 3 is a block diagram of an optical DAD device to which the presentinvention is applied;

FIG. 4 is a block diagram of an apparatus according to the invention;

FIG. 5 is a circuit diagram of a multiplier used in the apparatus shownin FIG. 4;

FIG. 6 is a block diagram of a divider used in the apparatus shown inFIG. 4;

FIG. 7 shows one of the linear shift registers shown in FIG. 6 and the"1" detector circuit connected to the linear shift register;

FIG. 8 shows the AND circuit section used in the divider shown in FIG.6;

FIG. 9 shows the OR circuit section used in the divider shown in FIG. 6;

FIG. 10 is a circuit diagram of the α⁶⁴ multiplier circuit used in thedivider shown in FIG. 6;

FIG. 11 is a block diagram of another divider according to theinvention;

FIG. 12 shows one of the linear shift registers shown in FIG. 11 and the"1" detector circuit connected to the linear shift register; and

FIG. 13 is a circuit diagram of the α¹ multiplier circuit used in thedivider shown in FIG. 11.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

With reference to FIG. 3, an optical DAD (digital audio disk) devicewhich uses compact disks (CD) will be described.

As shown in FIG. 3, the optical DAD device comprises a motor 111 forrotating a turntable 112. On the turntable 112 an optical disk 113 ismounted. The disk 113 has pits which correspond to digital audio signals(i.e. PCM codes) which have been EFM-modulated and interleaved. Anoptical pickup 114 emits a laser beam from a semiconductor laser 114a.The laser beam passes through a beam splitter 114b and is focused by anobjective lens 114c. The beam illuminates the track of the optical disk113, i.e., a train of pits which cause an interference between anincident laser beam and a reflected laser beam in various ways. The beamreflected from the pits passes through the objective lens 114c and thebeam splitter 114b. It is then guided to a four-element photodetector114d. The photodetector 114d converts the laser beam into four signals.The pickup 114 is moved by a pickup feed motor 115 in the radialdirection of the optical disk 113.

The four signals from the photodetector 114d are supplied to a matrixcircuit 116 and undergo a specific matrix operation. As a result, thematrix circuit 116 generates a focus error signal F, a tracking errorsignal T and a high-frequency signal RF. The focus error signal F and afocus search signal from a focus search circuit 110 drive a focus servosystem of the optical pickup 114. The tracking error signal T and searchcontrol signal from a system controller 117 drive a tracking servosystem of the pickup 114 and control the pickup feed motor 115. Thehigh-frequency signal RF is supplied to a reproduced signal processingsystem 118 as a major reproduced signal component. In the system 118 thesignal RF is supplied to a waveform shaping circuit 120 which iscontrolled by a slice level (eye pattern) detector 119. The waveformshaping circuit 120 divides the input signal into an unnecessary analogcomponent and a necessary data component. The necessary data componentis supplied to a sync clock reproducing circuit 121 of PLL type and alsoto an edge detector 122a of a first signal processing system 122.

A sync clock from the sync clock reproducing circuit 121 is supplied toa clock pulse generating circuit 122b. In response to the sync clock,the clock pulse generating circuit 122b generates a clock pulse fordividing a sync signal into components. On the other hand, the necessarydata component from the edge detector 122a is supplied to a sync signaldetector 122c. The sync signal detector 122c divides the data componentsin response to a sync signal dividing clock pulse from the clock pulsegenerating circuit 122b. The necessary data component from the edgedetector 122a is also supplied to a demodulating circuit 122d and thenEFM-demodulated. A sync signal from the sync signal detector 122c issupplied to a sync signal protecting circuit 122e and then to a timingsignal generating circuit 122f. A clock pulse signal from the clockpulse generating circuit 122b is also supplied to the timing signalgenerating circuit 122f. The timing signal generating circuit 122fgenerates a timing signal for processing input data.

An output signal from the demodulating circuit 122d is supplied througha data bus input/output control circuit 122g to an input/output controlcircuit 123a of a second signal processing system 123. The output signalfrom the demodulating circuit 122d contains a sub-code (i.e., a controlsignal) and a display signal component. The display signal component issupplied to a sub-code processing circuit 122_(i).

The sub-code processing circuit 122_(i) detects an error, if any, fromthe sub-code and corrects the error and then generates sub-code data.The sub-code data is supplied to the system controller 117 through aninterface circuit 122_(q) which is connected to the system controller117.

The system controller 117 includes a microcomputer, an interface circuitand a driver integrated circuit. In response to an instruction from acontrol switch 124 the system controller 117 controls the DAD device ina desired manner and causes a display device 125 to display thesub-code, e.g., index data about a piece of music to be reproduced.

A timing signal from the timing signal generating circuit 122f issupplied through a data selecting circuit 122_(j) to the data businput/output control circuit 122g and controls the data bus input/outputcontrol circuit 122g. The timing signal is supplied also to a frequencydetector 122_(k) and a phase detector 122_(l) and farther to a PWMmodulator 122_(m). The timing signal from the PWM modulator 122_(m) thenundergoes automatic frequency control (AFC) and automatic phase control(APC) so as to rotate the motor 111 at a constant linear velocity (CLV).

The phase detector 112_(l) is connected to receive a system clock pulsefrom a system clock pulse generating circuit 122_(p), which operatesunder the control of an output signal from a quartz crystal oscillator122_(n).

The demodulated data from the input/output control circuit 123a of thesecond signal processing system 123 is supplied through a data outputcircuit 123e to a D/A (digital-to-analog) converter 126 after it hasundergone necessary error correction, de-interleaving and datasupplementation at a syndrome detector 123b, and an error pointercontrol circuit 123c and error correction circuit 123d. The secondsignal processing system 123 includes an external memory control circuit123f. The control circuit 123f cooperates with the data selectingcircuit 122_(j) of the first signal processing system 122 to control amemory circuit 127 which is provided outside the system 123 and whichstores data necessary for correcting errors. Under the control of thecircuits 123f and 122_(j) the data are read from the external memory 127and supplied to the input/output control circuit 123a.

The second signal processing system 123 further comprises a timingcontrol circuit 123g and a muting control circuit 123_(h). The timingcontrol circuit 123g is designed so as to supply, in response to asystem clock pulse from the system clock pulse generating circuit122_(p), a timing control signal which is necessary for correctingerrors, supplementing data and converting digital data into analog data.The muting control circuit 123_(h) is designed to operate in response toa control signal from the error pointer control circuit 123c or from thesystem controller 117, thus performing a specific muting control whichis necessary in supplementing data and in starting and ending DADreproduction.

An audio signal, or an analog output signal from the D/A converter 126is supplied through a low-pass filter 128 and an amplifier 129 to aloudspeaker 130.

Now an apparatus according to the invention will be described which isused in the error correcting system of the optical DAD device shown inFIG. 3.

FIG. 4 shows an error location polynomial calculator provided in theerror correcting circuit 123d of the second signal processing system123. The calculator is identical to the conventional calculator shown inFIG. 2, except that it is provided with a multiplier 41 and a divider 42which multiply and divide the elements of a Galois field. The apparatusof the invention can therefore divide the elements of a Galois field,although it has neither a logarithm buffer nor an antilogarithm buffer.

The function of the error location polynomial calculator is to performvarious algebraic operations and thereby to decode an error correctioncode, i.e., a Reed Solomon code which is a BCH code. The calculatorperforms addition and detection of element "0" in the same way as thecalculator shown in FIG. 2. It performs multiplication and division indifferent ways, however. How the calculator achieves multiplication anddivision will be described below in detail.

Element α^(i) of Galois field GF(2⁸), for example, is multiplied byelement α^(j) of the Galois field GF(2⁸), where α is the root of amodulus polynomial F.sub.(x) =X⁸ +X⁶ +X⁵ +X⁴ +1. Let α^(i) and α^(j) begiven as follows:

    α.sup.i =C(α)=c.sub.0 +c.sub.1 α+. . . +c.sub.7 α.sup.7

    α.sup.j =D(α)=d.sub.0 +d.sub.1 α+. . . +d.sub.7 α.sup.7,

where c₀ -c₇ and d₀ -d₇ are each either 1 or 0. Then: ##EQU13##

The equation given above shows that the multiplication, α^(i) ·α^(j),can be performed by such a multiplier, or a linear shift register, asshown in FIG. 5.

The multiplier shown in FIG. 5 comprises AND gates AND₀ to AND₇. Thecoefficients d₀ to d₇ of the multiplier D(α) are supplied to themultiplier one after another. More specifically, the least significantbit d₇ is first supplied to one input of the AND gate AND₀, the secondleast significant bit α₆ is then supplied to one input of the AND gateAND₀ while the bit d₇ is supplied to one input of the AND gate AND₁, thethird least significant bit α₅ is supplied to the AND gate AND₀ whilethe bits α₇ and α₆ are supplied to the AND₂ and AND₁, and so forth. Thecoefficients c₀ to c₇ of the multiplicand C(α) are simultaneouslysupplied to the other inputs of the AND gates AND₀ to AND₇,respectively. The multiplier further comprises flip-flop circuits FF₀ toFF₇ and exclusive OR gates EX-OR₀ to EX-OR₇. The flip-flop circuits FF₀to FF₇ are connected by the exclusive OR gates EX-OR₀ to EX-OR₇ whichare connected at one input to the outputs of the AND gates AND₀ to AND₇,respectively. The output of the flip-flop FF₇ is coupled by a feedbackline to the other input of the flip-flop circuit FF₀. The flip-flopcircuits FF₀ to FF₇ therefore form a linear shift register SR₀.

An exclusive OR gate EX-OR₄ 'is connected at one input to the output ofthe exclusive EX-OR₄ and at the other input to the feedback line.Similarly, an exclusive OR gate EX-OR₅ 'is connected at one input to theoutput of the exclusive OR gate EX-OR₅ and at the other input to thefeedback line. In similar manner, an exclusive OR gate EX-OR₆ 'isconnected between the sixth flip-flop circuit FF₅ and the seventhflip-flop circuit FF₆. The clock terminals CK of the flip-flop circuitsFF₀ to FF₇ are connected by a clock supply line to a clock pulsegenerator (not shown) so that a clock pulse may be supplied to theflip-flop circuits FF₀ to FF₇ at the same time.

The coefficients d₀ to d₇ of the multiplier D(α) are supplied one afteranother to the AND gates AND₀ and AND₇, respectively. Then, X₀, X₁, X₂,. . . X₇ are calculated one after another, whereby the linear shiftregister SR₀ calculates C(α).D(α). The output signals x₀, x₁, . . . x₇from the flip-flop circuits FF₀ to FF₇ therefore represent the productof the multiplicand C(α) and the multiplier D(α).

x₀ to x₇ are given as follows:

    X.sub.0 =d.sub.7 C(α)

    X.sub.1 =X.sub.0 +d.sub.6 C(α)

    X.sub.2 =X.sub.1 +d.sub.5 C(α)

    X.sub.3 =X.sub.2 +d.sub.4 C(α)

    X.sub.4 =X.sub.3 +d.sub.3 C(α)

    X.sub.5 =X.sub.4 +d.sub.2 C(α)

    X.sub.6 =X.sub.5 +d.sub.1 C(α)

    X.sub.7 =X.sub.6 +d.sub.0 C(α)=(x.sub.0, x.sub.1, . . . x.sub.7)

The multiplier comprises a linear shift register instead of ROMs withlarge memory capacities which must store a logarithm table and anantilogarithm table of the elements of the Galois field GF(2⁸). By notusing a logarithm buffer or an antilogarithm buffer, the multiplier issimple in structure, inexpensive, and can still multiply the elements ofa Galois field GF(2^(m)).

Element α^(i) of the Galois field GF(2⁸), for example, is divided byelement α^(j) of the Galois field GF(2⁸), where α is the root of moduluspolynomial F.sub.(x) =x⁸ +x⁶ +x⁵ +x⁴ +1. The division, α^(i) ÷α^(j) isexpressed as follows:

    α.sup.i +α.sup.j =(α.sup.i ·α.sup.M)÷(α.sup.j ·α.sup.M),

where M is an integer.

If

    α.sup.j ·α.sup.M =α.sup.255 =α.sup.0 =1,

then:

    α.sup.i ÷α.sup.j =α.sup.i ·α.sup.M.

Hence, if α^(j) ·α^(M) =1 when both dividend α^(i) and divider α^(j) aremultiplied by α, M times, the product of α^(i) and α^(M), i.e., α^(i)·α^(M) is the quotient of the division: α^(i) ÷α^(j). This is the basicidea of the present invention.

Needless to say, dividend α^(i) and divider α^(j) are multiplied by αseveral times by means of such linear shift registers as describedabove.

When divider α^(j) is α¹, it must be multiplied by α as many as 254times (M=254) until it is reduced to "1". That is, α^(j) ·α^(M) =α²⁵⁵=α⁰ =1. Obviously, a long time is required to shift the linear shiftregister so many times in order to multiply divider α^(j) by α²⁵⁴.

According to the present invention, both dividend α^(i) and dividerα^(j) are multiplied by α a proper number of times (N) before they aresupplied to the linear shift registers, where N<M. It therefore sufficesto shift the linear shift registers fewer times than otherwise untildividend α^(i) and divider α^(j) become "1". This shortens the timenecessary for multiplication and, thus, the time necessary for thedivision α^(i) ÷α^(j).

FIG. 6 shows a divider for dividing the element of the Galois fieldGF(2^(m)) in such a manner as described above. The divider is sodesigned that dividend α^(i) and divider α^(j) are multiplied by α Ntimes before they are supplied to linear shift registers, where N=64,128 or 192 (1/n.2^(m), 2/n.2^(m), or 3/n.2^(m), m=8, n=4). In otherwords, dividend α^(i) and divider α^(j) are multiplied by α⁶⁴, α¹²⁸ orα¹⁹² before they are supplied to the linear shift registers.

More specifically, divider data α^(j) are supplied to a linear shiftregister A₁, to a linear shift register A₂ through an α⁶⁴ multipliercircuit 51, to a linear shift register A₃ through an α¹²⁸ multipliercircuit 52 and to a linear shift register A₄ through an α¹⁹² multipliercircuit 53. These linear shift registers A₁, A₂, A₃ and A₄ are identicalto the linear shift register SR₀ shown in FIG. 5. They are shifted by aclock pulse C_(p) supplied through an AND gate AND₁₁. Every time theyare shifted, the data stored in them are multiplied by α. The outputs ofthe linear shift registers A₁, A₂, A₃ and A₄ are supplied to "1"detector circuits 54, 55, 56 and 57, respectively. Each of the "1"detector circuits 54, 55, 56 and 57 generates an output signal when thecontents of the linear shift register connected to it are "10000000"(=1). The outputs of the "1" detector circuits 54, 55, 56 and 57 arecoupled to a 4-input NOR gate NOR₁₀. The output of the NOR gate NOR₁₀ iscoupled to one input of the AND gate AND₁₁, the other input of which isconnected to receive a clock pulse C_(p). Hence, when any one of the "1"detector circuits 54 to 57 generates an output signal of logical "1",the NOR gate NOR₁₀ generates an output of logical "0", whereby the ANDgate AND₁₁ stops supplying clock pulses C_(p).

Dividend data α^(i) are supplied to a linear shift register B₁, a linearshift register B₂ through an α⁶⁴ multiplier circuit 58, a linear shiftregister B₃ through an α¹²⁸ multiplier circuit 59 and a linear shiftregister B₄ through an α¹⁹² multiplier circuit 60. They are shifted by aclock pulse C_(p) supplied through the AND gate AND₁₁. Every time theyare shifted, the data stored in them are multiplied by α. The outputs ofthe linear shift registers B₁, B₂, B₃ and B₄ are supplied to ANDcircuits 61, 62, 63 and 64, respectively.

The AND circuits 61, 62, 63 and 64 are connected to the outputs of the"1" detector circuits 54, 55, 56 and 57, respectively. Hence, the ANDcircuit 61 supplies the logical product of the outputs from the "1"detector circuit 54 and shift register B₁. The AND circuit 62 producesthe logical product of the outputs from the "1" detector circuit 55 andshift register B₂. Similarly, the AND circuits 63 and 64 generate thelogical product of the outputs from the "1" detector circuit 56 andshift register B₃ and the logical product of the outputs from the "1"detector circuit 57 and shift register B₄, respectively.

The outputs from the AND circuits 61 to 64 are supplied to a 4-input ORcircuit 65, whereby element α^(i) is divided by element α^(j).

The linear shift registers A₁ to A₄ have the same structure. As shown inFIG. 7, each linear shift register is an 8-bit register. The "1"detector circuits 54 to 57 have the same structure. As shown in FIG. 7,each "1" detector circuit is a NOR gate NOR₁₁ having eight inputterminals. Only the bit of the shift register which corresponds to α¹ iscoupled to the first input terminal of the NOR gate NOR₁₁ through aninverter I₁₀. The second to eighth bits of the register are directlyconnected to the second to eighth input terminals of the NOR gate NOR₁₁,respectively.

The AND circuits 61 to 64 have the same structure. As shown in FIG. 8,each AND circuit consists of eight AND gates AND₂₀ to AND₂₇ each withtwo input terminals. The AND gates AND₂₀ to AND₂₇ are connected at oneinput terminal to the corresponding linear shift register B₁, B₂, B₃ orB₄ which are 8-bit registers. More precisely, the AND gates AND₂₀ toAND₂₇ are connected at one input terminal to the first to eighth bits ofthe linear shift register, respectively. The AND gates AND₂₀ to AND₂₇are coupled at the other input terminal to the corresponding "1"detector circuit 54, 55, 56 or 57.

FIG. 9 shows the OR circuit 65 used in the divider shown in FIG. 6. TheOR circuit 65 consists of eight 4-input OR gates OR₂₀ to OR₂₇. The ORgates OR₂₀ to OR₂₇ are connected at the first input terminal to theoutputs of the eight AND gates of the AND circuit 61, respectively. Theyare coupled at the second input terminal to the outputs of the eight ANDgates of the AND circuit 62. They are coupled at the third inputterminal to the outputs of the eight AND gates of the AND circuit 63.And they are connected to the 4-input terminal to the outputs of theeight AND gates of the AND circuit 64, respectively.

FIG. 10 shows the α⁶⁴ multiplier circuit 58 used in the divider shown inFIG. 6. The circuit 58 is designed upon the assumption that dividerα^(j) is given as follows:

    α.sup.j =B(α)=b.sub.7 α.sup.7 +b.sub.6 α.sup.6 + . . . b.sub.1 α+b.sub.0,

where b₁ to b₇ are 0 or 1.

Since

    α.sup.64 =α.sup.7 +α.sup.6 +α.sup.5, ##EQU14##

This algebraic operation is performed by exclusive-OR gates EX-OR₁₁ toEX-OR₂₅ which are connected as illustrated in FIG. 10. When datarepresenting B(α) are supplied to the α⁶⁴ multiplier circuit 58, thecircuit 58 will generate output data representing α⁶⁴ ·B(α). The α¹²⁸multiplier circuit 59 and the α¹⁹² multiplier circuit 60 have structureswhich are similar to that of the α⁶⁴ multiplier circuit 58. The dividershown in FIG. 6 divides α²⁰⁰ by α¹⁸⁰ in the following manner, thusproviding data representing α²⁰. First, divider data α¹⁸⁰ are stored inthe linear shift registers A₁ to A₄ and dividend data α²⁰⁰ are stored inthe linear shift registers B₁ to B₄, as shown below: ##EQU15##

Then, clock pulses C_(p) are supplied from the AND gate AND₁₁ to thelinear shift registers A₁ to A₄ and the linear shift registers B₁ to B₄.When the 11th clock pulse C_(p) is supplied to the registers A₁ to A₄and B₁ to B₄, the data stored in the register A₂ changes to α²⁵⁵ (=1).The "1" detector circuit detects this, and the NOR gate NOR₁₀ suppliesan output of logical "0" to the AND gate AND₁₁. As a result, the ANDgate AND₁₁ stops supplying clock pulses C_(p) to the registers A₁ to A₄and B₁ to B₄. At this time the data stored in the register B₂ representα²⁰. The data representing α²⁰, i.e., the quotient of the division α²⁰⁰÷α¹⁸⁰, are supplied through the AND circuit 62 and the OR circuit 65.The divider shown in FIG. 6 can therefore divide any element α^(i) ofthe Galois field GF(2⁸) by any other element α^(j) of the Galois fieldGF(2⁸) by multiplying the divider data stored in the linear shiftregister A₁, A₂, A₃ or A₄ and the dividend data stored in the linearshift register B₁, B₂, B₃ or B₄ by α, 63 times at the most, in the caseof α^(j) =α¹.

If more linear shift registers are used for multiplying both the dividerα^(j) and the dividend α^(i) by α, the divider α^(j) and the dividendα^(i) need to be multiplied by α fewer times until they are changed toα²⁵⁵.

FIG. 11 shows another divider according to the present invention, whichcan divide the elements of the Galois field GF(2⁸) by performingmultiplications of the elements. In this divider, both dividend α^(i)and divider α^(j) are multiplied by α N times before they are suppliedto linear shift registers, where N=1, 2 and 3. In other words, dividendα^(i) and divider α^(j) are multiplied by α¹, α² and α³ before they aresupplied to the linear shift registers. Both dividend α^(i) and dividerα^(j) are then multiplied by α⁴ in the linear shift registers.

More specifically, as shown in FIG. 11, divider data α^(j) are suppliedto a linear shift register A₁, to a linear shift register A₂ through anα¹ multiplier circuit 51, to a linear shift register A₃ through an α²multiplier circuit 52, and to a linear shift register A₄ through an α³multiplier circuit 53. The linear shift registers A₁, A₂, A₃ and A₄ areidentical and have a structure as shown in FIG. 12. Each of the linearshift registers A₁ to A₄ is an 8-bit register. It comprises flip-flopcircuits FF₁₀ to FF₁₇ and exclusive-OR gates EX-OR₁₀ to EX-OR₃₁. Theflip-flop circuits FF₁₀ to FF₁₇ are cascade-connected andfeedback-connected by the exclusive-OR gates EX-OR₁₀ to EX-OR₃₁. Everytime a clock pulse C_(p) is supplied to the linear shift registers A₁ toA₄ from an AND gate AND₁₀ shown in FIG. 11, the registers A₁ to A₄ areshifted to multiply the data stored in them by α⁴.

As shown in FIG. 11, the outputs of the linear shift registers Al, A2,A3 and A4 are connected to "1" detector circuits 54, 55, 56 and 57,respectively. Each of the "1" detector circuits 54 to 57 consists of oneinverter I₁₀ and an 8-input NOR gate NOR₁₀ as shown in FIG. 12. Itgenerates an output signal of logical "1" when the contents of thelinear shift register connected to it are "10000000". The outputs of the"1" detector circuit 54, 55, 56 and 57 are coupled to the inputterminals of a 4-input NOR gate NOR₁₁ (FIG. 11), respectively. The NORgate NOR₁₁ generates an output signal of logical "0" when any one of the"1" detector circuits 54 to 57 generates an output of logical "1". Theoutput of the NOR gate NOR₁₁ is connected to the AND gate AND₁₀. Hence,when an output of logical " 0" is supplied from the NOR gate NOR₁₁ tothe AND gate AND₁₀, the AND gate AND₁₀ stops supplying clock pulsesC_(p).

Dividend data α^(i) are supplied to a linear shift register B₁, to alinear shift register B₂ through an α¹ multiplier circuit 58, to alinear shift register B₃ through an α² multiplier circuit 59 and to alinear shift register B₄ through an α³ multiplier circuit 60. The linearshift registers B₁ to B₄ are shifted every time they receive a clockpulse C_(p) from the AND gate AND₁₀, thereby multiplying the data storedin them by α⁴.

The outputs of the linear shift registers B₁, B₂, B₃ and B₄ areconnected to AND circuits 61, 62, 63 and 64, respectively. The outputsof the "1" detector circuits 54, 55, 56 and 57 are connected to the ANDcircuits 61, 62, 63 and 64, respectively. Hence, the AND circuit 61generates the logical product of the outputs from the "1" detectorcircuit 54 and shift register B₁. The AND circuit 62 produces thelogical product of the outputs from the "1" detector circuit 55 andshift register B₂. The AND circuit 63 supplies the logical product ofthe outputs from the "1" detector circuit 56 and shift register B₃.Similarly, the AND circuit 64 generates the logical product of theoutputs from the "1" detector circuit 57 and shift register B₄.

The outputs from the AND circuits 61 to 64 are supplied to a 4-input ORcircuit 65, whereby element α^(i) is divided by element α^(j).

As shown in FIG. 8, each of the AND circuits 61 to 64 consists of eightAND gates AND₂₀ to AND₂₇ each with two input terminals. The AND gatesAND₂₀ to AND₂₇ are connected at one input terminal to the correspondinglinear shift registers B₁, B₂, B₃ and B₄ which are 8-bit registers. Moreprecisely, the AND gates AND₂₀ to AND₂₇ are coupled at one inputterminal to the first to eighth bits of the linear shift register,respectively. The AND gates AND₂₀ to AND₂₇ are coupled at the otherinput terminal to the corresponding "1" detector circuit 54, 55, 56 or57.

The OR circuit 65 is identical with the circuit shown in FIG. 9. Itconsists of eight 4-input OR gates OR₂₀ to OR₂₇. The OR gates OR₂₀ toOR₂₇ are connected at the first input terminal to the outputs of theeight AND gates of the AND circuit 61, respectively. They are coupled atthe second input terminal to the outputs of the eight AND gates of theAND circuit 62. They are coupled at the third input terminal to theoutputs of the eight AND gates of the AND circuit 63. And they areconnected at the fourth input terminal to the outputs of the eight ANDgates of the AND circuit 64, respectively.

FIG. 13 shows the α¹ multiplier circuit 58 used in the divider shown inFIG. 11. The α¹ multiplier circuit 58 is designed upon the assumptionthat divider α^(j) is given as follows:

    α.sup.j =B(α)=b.sub.7 α.sup.7 +b.sub.6 α.sup.6 + . . . +B.sub.1 α+b.sub.0.

In this case, α·B(α) is expressed as follows: ##EQU16##

Therefore, the α¹ multiplier circuit 58 is comprised of exclusive-ORgates EX-OR₃₂ to EX-OR₃₄ which are connected as shown in FIG. 13. Whenthe circuit 58 receives input data representing B(α), it generatesoutput data representing α·B(α), i.e. the product of B(α) and α.

The α² multiplier circuit 59 and the α³ mutliplier circuit 60 havestructures which are similar to that of the α¹ multiplier circuit 68.

The divider shown in FIG. 11 divides element α^(i) of the Galois fieldGF(2⁸) by element α^(j) of the Galois field GF (2⁸) in the followingmanner.

First, divider data α^(j) are supplied to the linear shift register A₁,to the linear shift register A₂ through the α¹ multiplier circuit 51, tothe linear shift register A₃ through the α² multiplier 52 and to thelinear shift register A₄ through the α³ multiplier circuit 53. At thesame time, dividend data α^(i) are supplied to the linear shift registerB₁, to the linear shift register B₂ through the α¹ multiplier circuit58, to the linear shift register B₃ through the α² multiplier circuit 59and to the linear shift register B₄ through the α³ multiplier circuit60. The data stored in the shift registers A₁ to A₄ and the shiftregisters B₁ to B₄ are as listed below: ##EQU17##

Then, clock pulses C_(p) are supplied from the AND gate AND₁₀ to thelinear shift registers A₁ to A₄ and the linear shift registers B₁ to B₄.Every time the shift registers A₁ to A₄ and B₁ to B₄ receive a clockpulse C_(p), they are shifted, thereby multiplying the data stored inthem by α⁴. When the data stored in any one of the shift registers A₁ toA₄ are changed to α²⁵⁵ (=1), the "1" detector circuit connected to theshift register generates an output signal of logical "1". As a result,the AND gate AND₁₀ stops supplying clock pulses C_(p) to the shiftregisters A₁ to A₄ and B₁ to B₄. At the same time, the linear shiftregister B₁, B₂, B₃ or B₄ which corresponds to the shift register nowstoring data α²⁵⁵ (=1) supplies its contents to the AND circuit to whichit is connected. The contents of the linear shift register B₁, B₂, B₃ orB₄, which represent the quotient of division α^(i) ÷α^(j), are deliveredfrom the OR circuit 65.

More specifically, the divider shown in FIG. 11 divides element α¹⁰ ofthe Galois field GF(2⁸) by element α²⁴⁰ of the Galois field GF(2⁸) inthe following manner so as to obtain the quotient α⁻²³⁰ (=α¹⁰⁻²⁴⁰=α⁻²³⁰⁺²⁵⁰ =α²⁵).

First, divider data α²⁴⁰ are supplied to the linear shift register A₁.The data are supplied also to the linear shift registers A₂, A₃ and A₄through the α¹ multiplier circuit 51, α² multiplier circuit 52 and α³multiplier circuit 53, respectively. At the same time, dividend data α¹⁰are supplied to the linear shift register B₁. The data α¹⁰ are alsosupplied to the linear shift register B₂, B₃ and B₄ through the α¹multiplier circuit 58, α² multiplier circuit 59 and α³ multipliercircuit 60, respectively. The shift registers A₁ to A₄ and the shiftregisters B₁ to B₄ then store the data listed below: ##EQU18##

Clock pulses C_(p) are then supplied one after another from the ANDgate¹⁰ to the shift registers A₁ to A₄ and B₁ to B₄. When the thirdclock pulse C_(p) is supplied to the shift registers A₁ to A₄ and B₁ toB₄, the data stored in the shift registers are multiplied by α¹² (=α⁴·α⁴ ·α⁴). Hence, the shift registers A₁ to A₄ and B₁ to B₄ store thefollowing data: ##EQU19##

The register A₄ now stores data α²⁵⁵ (=1). The data α²⁵ stored in theshift register B₄ which corresponds to the register A₄ are thereforesupplied as the quotient from the OR circuit 65.

As described above, the linear shift registers A₁ to A₄ and B₁ to B₄multiply the data stored in them by α⁴ every time they are shifted. Thedivider of FIG. 11 can therefore divide any element α¹ of the Galoisfield GF(2⁸) by another element α^(j) of the Galois field GF(2⁸) bymultiplying both the dividend α^(i) and the divider α^(j) by α, 63 timesat most, in the case where α^(j) =α¹.

Two linear shift registers A₅ and B₅ may be used in addition to theshift registers A₁ to A₄ and B₁ to B₄ and two α⁵ multiplier circuits maybe connected to the inputs of the registers A₅ and B₅, respectively. Inthis case, the division α^(j) -α^(j) j can be performed by multiplyingboth dividend α^(i) and divider α^(j) by α, 50 times at least.

The present invention is not limited to the embodiments described above.Various changes and modifications are possible within the scope of theinvention. For example, the apparatus of the invention may be used incombination with a system for recording, reproducing and transmittingdigital data such as PCM data, a system for processing such data or anyother system in which one of the elements of the Galois field needs tobe divided by another element of the Galois field.

As described above in detail, the present invention can provide anapparatus for dividing the elements of a Galois field, which has neithera logarithm buffer nor an antilogarithm buffer, both of which need tohave a large memory capacity, and which therefore has a simple structureand can be manufactured inexpensively, and which can still operate at ahigh speed.

What we claim is:
 1. An apparatus for dividing one element α^(i) of aGalois field GF(2^(m)) consisting of 2^(m) elements by another elementα^(j), thus performing a division of α^(i) ÷α^(j), where α is the rootof a modulus polynominal F.sub.(x), said apparatus comprising:a firstlinear shift register for storing data representing the element α_(j) ;a second linear shift register for storing data representing the elementα^(i) ; a first "1" detector circuit connected to the output of saidfirst linear shift register; first shift means for detecting the numberof times said first "1" detector circuit produces no output and forgenerating a shift signal to shift said first and second linear shiftregisters M times according to the detecting result; and first outputmeans for providing, as a quotient of the division α^(i) ÷α^(j), thatoutput α^(i) ·α^(M) of said second linear shift register which isobtained when the output of said first linear shift register controlledby said first shift means becomes α^(j) ·α^(M) =1, when said firstoutput means receives a "1" detection output of said first "1" detectorcircuit which is obtained when said first "1" detector circuit detectsthat α^(j) ·α^(M) =1.
 2. An apparatus according to claim 1, furthercomprising:at least one first multiplier circuit for multiplying theelement α^(j) by a predetermined multiplier α^(N) ; at least one secondmultiplier circuit for multiplying the element α^(i) by thepredetermined multiplier α^(N) ; at least one third linear shiftregister for receiving the output of said first multiplier circuit; atleast one fourth linear shift register for receiving the output of saidsecond multiplier circuit; at least one second "1" detector circuitcoupled to the output of said third linear shift register; at least onesecond shift means for detecting the number of times said second "1"detector circuit produces no output and producing a shift signal toshift said third and fourth linear shift registers M times according tothe detection result; and at least one second output means forproviding, as a quotient of the division α^(i) ÷α^(j), that output α^(i)·α^(N) ·α^(M) of said fourth linear shift register which is obtainedwhen the output of said third linear shift register controlled by saidsecond shift means becomes α^(j) ·α^(N) ·α^(M) =1, in response to a "1"detection output of said second "1" detector circuit which is obtainedwhen said second "1" detector circuit detects that α^(j) ·α^(N) ·α^(M)=1.
 3. An apparatus according to claim 2, wherein the power N of themultiplier α^(N) for said first and second multiplier circuits is amultiple of 1/n 2^(m) (n≧2).
 4. An apparatus according to claim 2,wherein the power N of the multiplier α^(N) for said first and secondmultiplier circuits is a multiple of
 1. 5. An apparatus according toclaim 1, wherein when shifted, each of said first and second linearshift registers provides data that equals stored data multiplied by αfor each shifting.
 6. An apparatus according to claim 1, wherein whenshifted, each of said first and second linear shift registers providesdata that equals stored data multiplied by α^(NO) (NO≧2) for eachshifting.